ADR / Evidence, claims and footage / Divorce, probate, company rows

Civil and family matters · what the machine can be made to say

Forensic evidence for civil cases. A file date is an assertion. Only the machine around it settles anything.

Civil is not criminal, and the difference works in your favour here. A document that has been altered, with a row about when. A director kept away from records his own company keeps. Money at issue in a divorce; a will disputed; two partners and one deleted file between them; the camera on the building next door, which ends up being the only witness there was. The statutory Code that the Forensic Science Regulator administers reaches criminal proceedings and stops, so no part of this page sits under it and no part of it calls for accreditation. What does apply is CPR Part 35 with PD35, and the report is built to answer them line by line. Scoping costs you nothing; one figure then goes in writing before any chargeable work — from £800 + VAT.

The duty runs to the court first Authority agreed before we start Imaged before a folder opens

Talk it over with an engineer, in confidence
0203 0868633

What a file date can and cannot show.

Three dates sit on every fileCreated marks the moment a file arrived on this volume, and copying it elsewhere restarts that clock. Modified answers to the contents changing. Accessed shifts for unremarkable reasons: a backup process, or an antivirus sweep. All three are equally open to being set by hand.

What a deletion really leavesA deleted file usually stays exactly where it was until the disk wants that space back. Entries held within an application's database work otherwise: some linger in free pages that carving still reaches, others go the moment they are removed. Which of the two it is gets established, never assumed.

A screenshot proves almost nothingThere is no device behind a screenshot, no underlying record, nothing to hash. A convincing one takes about a minute to produce, and if you do not say so the other side will. The machine itself is the evidence.

One date, on its own, settles nothingPut the timestamp next to everything else the machine holds — event logs, recent documents, backup records, sync history. Either the rest agrees with it or it does not, and finding that out is the work.

Every Part 35 rule, and how this bench meets it.

Not listed? Tell us what it does →

Rule cited	What it demands	How we satisfy it
CPR 35.3 — the duty that ranks first	The expert helps the court, and that obligation is ranked above anything owed to whoever is paying	Stated at the top of the report, and every finding below answers to it
CPR 35.4 — permission from the court	An application has to name the field of expertise, the issues it will address and the likely cost of it	You get the written scope and the figure in time to put both into the application
PD35 at paragraphs 3.2 and 3.3	Nine required contents, whatever spread of opinion there is, then a statement of truth exactly as the direction words it	All nine are covered, and the examiner is named
CPR 35.7 — one expert, both parties	The court may direct a single expert, instructed jointly, to give the evidence	We accept joint instructions, and both sides receive the same report
CPR 35.6 — questions put in writing	A single round of clarifying questions, put within 28 days	Answers are written, and they then form part of the report

How it reaches us:send it by tracked, insured post; Guildford takes it in, and the leg home is on us. Unsure what should travel with it? A call before the box is sealed will get you an engineer who can say what to include and what stays behind. The whole of it is spelled out on theguide to packing and posting.

The sequence we follow.

Other jobs on the log →

Say what has happened, in confidence — then a figure in writing Free

Forensic instructions start at £800 + VAT, and where a particular job lands within that depends on scope — which is what the first conversation is for: the dates and events in dispute, the machines and accounts in play, and what has to be shown. That conversation is not charged for, and no work that costs you anything begins before the written figure reaches you.

That call goes no further than usA single figure, put in writingThe questions evidence must settle

The image comes before the look

There is nothing ceremonial about it: a full image exists before any folder is opened. Open one first and dates the case may turn on shift under you. Worse, the other side gets a free question out of it: who picked the folders worth reading? Nothing is picked here, and nothing is filtered out.

The copy comes before anythingNothing opened beforehand

The original is stored; the work runs on the image

The original goes into access-controlled storage and stays there. Every later step runs on the image: the documents at issue and what the file system holds against each of them; deleted material carving can still reach; whatever the machine noted about drives plugged in, accounts signed into, syncing carried out. Where two dates contradict each other, the report says which it prefers and gives the reason.

Documents, mail, messagesCarved-back deleted material

The report is written for the court

PD35 addresses a report to the court, not to the party funding it, and that is the voice used throughout. Qualifications open it. Then the material relied on, the substance of our instructions, who did the work, and the range of opinion where one exists. A statement of truth closes it, worded as PD35 prescribes. Accreditation was dealt with on page one.

Written to CPR Part 35 with PD35A signed statement of truth on it

What the bundle holds, and who signed for it

Hand the other side a finding they have no way of testing and the argument is theirs. So the bundle carries the lot: every exhibit numbered, every hash, handovers dated and countersigned, the image behind each conclusion, and the notes written up at the bench while the work went on. Repeat the steps and the result does not move.

Each finding tied to an exhibitHashes taken, and each handover loggedEvery step can be repeated

What the bench has learned

Family work turns on authority — the household computer neither of you would call solely yours, the laptop paid for by one and worked on by both, the company machine a director never handed back. Three sets of facts, three answers.
No authority means no job — and that is not paperwork for its own sake. Unauthorised access offends the Computer Misuse Act 1990 at its first section, and a laboratory holds no exemption from that.
Cheap providers overreach at exactly this point — a created date handed over as though it were settled, and no account given of how they got there. Nothing on a disk shifts more readily than that value. A copy resets it, a restore resets it again, and the clock may never have been set right. Ours carry the qualification with them.
Handsets do not come to this bench — computers, drives and cards do, and so does a phone backup that was written onto a computer. Where the handset is itself the thing in dispute, say so when you ring and we will point you elsewhere.

The question solicitors raise first: CPR 35.10 requires the substance of every material instruction, spoken or written, to appear in the report, and privilege will not hold it back. The safeguard sits in the same rule: neither the underlying documents nor cross-examination upon them is allowed unless the court thinks the statement of instructions incomplete or inaccurate. Useful to know while a letter of instruction is still being drafted. As for the statement of truth, its wording is set by PD35 3.3, and the direction warns that signing one without honest belief amounts to contempt.

One job, followed all the way through.

LDN · ADR-2026-3413JOB LOGGED ✓

The file was older than the machine holding it

Two partners in Hackney fell out over the accounts, and one of them produced a document dated before they separated. The computer that had made it was bought afterwards, and the record held within the file agreed with the disk. Our report gave the date, set out how we had got to it, and added a plain qualification: nothing on that drive showed whose hands had been at the keyboard. A settlement followed not long after.

At an endand no hearing was neededThe order of eventssettled between both sides

What helps, and what harms.

Do this much first

Work out who is entitled to authorise the examination
Leave the machine alone — every hour it runs shifts dates you may want
Say in the instruction which facts are genuinely disputed
Raise early whether one joint expert would suit the court

What sets us back

Sending a device nobody has authorised you to submit
Having a look through it yourself
Offering screenshots when only the machine itself will do
Clearing the drive down before it has been imaged

The questions that come up first.

Is any of this covered by the statutory Code?

It is not, and the reason repays a minute of your time. The Code the Regulator administers is confined to criminal proceedings, England and Wales only, and the standard it names there is ISO/IEC 17025. An argument over a boundary is no criminal proceeding. Neither is a financial remedy application, and neither is a falling-out among directors. This laboratory holds no accreditation for work of any description in any event, and page one of every report says precisely that.

Which machines am I entitled to send?

Only ones released to you by somebody with the right to say yes. Under the Computer Misuse Act 1990, reading a machine you have no right to read is a section 1 offence, and a laboratory answers to it exactly as you do. A shared household machine, a machine one of you paid for, a machine that is plainly theirs: three sets of facts and three answers that differ. Raise it with your solicitor before anything is posted.

How much does a created date really prove?

That a file arrived on that volume at that moment, and not one thing beyond it. It is silent on when the words were typed and silent on who typed them. Copy the file and the value starts again. A clock can be wound back by hand in under a minute. Modified moves, accessed moves, and frequently nobody intended either. A date is an assertion until the rest of the machine backs it.

Can deleted messages be retrieved?

That turns on where they were kept. Computers, drives and cards are read here; handsets are not, at all. An entry deleted from an application database can sit on in free pages — a browser profile, a mail client on the desktop, a phone backup written onto a computer — for as long as nothing claims that space. Once something else occupies it, there is nothing to return.

Begin here if yours is doing the same thing.

What a forensic job involves → What goes into the report → What is left after a delete → Work that reaches court →

Off the mains first, because that is what protects the evidence.

Whatever holds the evidence, take it off power before anything else — a recorder that is still running overwrites its own oldest material, hour by hour. Send it to us after that. Looking costs nothing; recorder work is £400 + VAT and forensic instructions start at £800 + VAT, both settled in writing beforehand. What sits on that disk stays here.

0203 0868633

Price my job Sending it to Guildford

Drives, cards and entire machines

Whatever it is doing now

Footage, evidence and reports

What it costs, and what follows